How to avoid Assymetric Routing with Fortigate with a new BGP link

[roxy_kk]

HI All,

Have a setup where I have a pair of Fortigate FW cluster (A-P)  connected into ACI Fabric under a VRF1. Have BGP configured to learn routes dynamically . There is a new requirement to create a new VRF2 on the Fabric and move this BGP connection onto that .While configuring this on the firewall we plan to create a new interface in the same zone and plan to move traffic from Link 1 to Link 2. Now it is understood that when we do this we will end up breaking existing connections which are in the session table ( with successful 3 way handshakes) . Trying to find a solution where by we can move the traffic from the primary link to secondary link without impacting existing connections. Any ideas ?

[spoojary]

To move traffic from the primary link to the secondary link without impacting existing connections when transitioning to a new VRF and interface setup in a FortiGate firewall cluster connected to an ACI fabric, mplement route leaking between VRF1 and VRF2 using BGP to allow communication between the two VRFs without impacting existing connections. This ensures that traffic can flow between the VRFs seamlessly. Create policy routes to redirect specific traffic from the primary link to the secondary link without affecting existing connections. By configuring policy routes, you can control the flow of traffic based on specific criteria, such as source address or protocol.

[Toshi_Esumi]

Until seeing and examining the detailed network diagram including HA compoenents, two VRFs and BGP neighborings, probably nobody would be able to provide any useful information toward the "solutions". Besides, VRF separation and route leaking are two networking mechanisms that could work against each other. There are certain situations leaking specific routes, such as management traffice, while all other other routes/traffic need to be separated/isolated each others.

Also it's not clear if you're concerning about the migration without having a maintenance window or fail-over situations after the migration is done.
But this kind of design consideration is probably beyond this FTNT community.

Toshi